玩转华为ENSP模拟器系列 | 配置OSPFv3 HMAC-SHA256认证示例

素材来源：华为路由器配置指南

一边学习一边整理试验笔记，并与大家分享，侵权即删，谢谢支持！

附上汇总贴：玩转华为ENSP模拟器系列 | 合集_COCOgsta的博客-CSDN博客_ensp实验大全

---

目标

验证OSPFv3的HMAC-SHA256认证功能，分别采用key-id和keychain的配置方式实现

组网需求

配置思路

• CX1与CX2建立OSPFv3邻居，确认邻居可以建立

• 设置设备之间采用HMAC-SHA256认证，采用key-id方式验证，确认可以正常建立邻居关系

操作步骤

1. CX1与CX2接口配置（略）
2. CX1与CX2之间建立无认证的OSPFv3邻居关系

CX1的OSPFv3配置

CX1:
ospfv3 1
 router-id 1.1.1.1
 area 0.0.0.0

CX2的OSPFv3配置

CX2:
ospfv3 1
 router-id 2.2.2.2
 area 0.0.0.0

1. 查看OSPFv3邻居状态，确认可正常建立邻居关系。以CX1为例：

[~CX1-Ethernet1/0/0]dis ospfv3 peer verbose 
OSPFv3 Process (1)
 Neighbor 2.2.2.2 is Full, interface address FE80::3A70:AAFF:FE02:100
    In the area 0.0.0.0 via interface Eth1/0/0
    DR Priority is 1 DR is 2.2.2.2 BDR is 1.1.1.1
    Options is 0x000013 (-|-|-|-|-|-|R|-|-|E|V6)
    Dead timer due in 00:00:38
    Neighbour is up for 00h14m12s
    Neighbour Up Time : 2020-12-01 20:25:28
    Link State Request List 0
    Link State Retransmission List 0
    Neighbour Event: 6
    Neighbour If Id : 0x06
[~CX1-Ethernet1/0/0]

1. 修改CX1的OSPFv3认证方式

CX1:
interface Ethernet1/0/0
ospfv3 authentication-mode hmac-sha256 key-id 1 cipher Admin@1234 

1. 查看OSPFv3邻居状态，因CX1配置了认证，而CX2没有配置认证，故OSPFv3邻居无法建立。以CX1为例：

[~CX1-Ethernet1/0/0]dis ospfv3 peer verbose 
[~CX1-Ethernet1/0/0]

1. 修改CX2的OSPFv3认证方式

CX2:
interface Ethernet1/0/0
 ospfv3 authentication-mode hmac-sha256 key-id 1 cipher Admin@1234

1. 再次查看OSPFv3邻居状态，此时CX1和CX2都启用了HMAC-SHA256认证，邻居可以正常建立。

[~CX1-Ethernet1/0/0]dis ospfv3 peer verbose 
OSPFv3 Process (1)
 Neighbor 2.2.2.2 is Full, interface address FE80::3A70:AAFF:FE02:100
    In the area 0.0.0.0 via interface Eth1/0/0
    DR Priority is 1 DR is 2.2.2.2 BDR is 1.1.1.1
    Options is 0x000413 (AT|-|-|-|-|-|R|-|-|E|V6)
    Dead timer due in 00:00:32
    Neighbour is up for 00h01m36s
    Neighbour Up Time : 2020-12-01 20:43:11
    Link State Request List 0
    Link State Retransmission List 0
    Neighbour Event: 5
    Neighbour If Id : 0x06
    Received Higher Order Sequence Number : 0
    Received Lower Order Sequence Number  : 19
[~CX1-Ethernet1/0/0]